fix(config): harden RAFTER_API_KEY handling — 0600 perms, redaction, wire backend.apiKey (sable-q9to)

[Rome-1]

Fixes sable-q9to. Three credential-handling gaps in RAFTER_API_KEY handling (both Node + Python). The intended env-var / --api-key path was already solid (HTTPS, x-api-key header only, not logged); these are the storage/display/dead-path gaps surfaced during the secbolt credential spike.

Gaps fixed

1. Plaintext, world-readable. ConfigManager.save() wrote ~/.rafter/config.json with the default umask (typically 0644). Now writes 0600 (dir 0700) and chmods an existing looser-perm file on the next write.
2. Unredacted echo. config show/get, the config set confirmation, and the MCP get_config tool + rafter://config / rafter://policy resources serialized the full config verbatim — handing any stored key to the terminal or MCP client. Added redactConfigSecrets/maskSecretValue (mask values under keys matching api_?key|token|secret|password|credential → abcd****), applied at every render path. Pure — the stored config is never mutated.
3. Dead credential path. backend.apiKey existed in the schema but resolveKey never read it. Wired as the lowest-precedence source: --api-key flag → RAFTER_API_KEY env → global config backend.apiKey.

Security design

• Why 0600 plaintext, not encryption: it's a bearer token (presented verbatim → can't hash); encrypting a local CLI config needs a KEK the CLI reads unattended, sitting right next to the ciphertext ("keys next to data"). So the boundary is file perms + display redaction — same as gh/aws/npm.
• Trust boundary (verified): the config fallback is read only from the global ~/.rafter/config.json via load() — loadWithPolicy() never merges backend.*, so a hostile project-local .rafter.yml cannot inject an API key that redirects scans to an attacker's account. Confirmed empirically (a planted .rafter.yml backend.apiKey does not appear in config show and resolveKey refuses it).
• Ran rafter-secure-design before coding (decisions recorded on the bead); refuse-list clean (no homegrown crypto, opaque bearer token, revocation is backend-side).

Tests

New config-secret-handling suites in both languages: redaction helpers (mask/leaf-match/no-mutation), save() writes 0600 on fresh and tightens an existing 0644 file, and resolveKey precedence flag > env > config. Node 67 / Python 19 config tests pass; broader config + mcp + api suites green. Secrets scan clean on all changed files. rafter run (remote SAST) not run — no RAFTER_API_KEY in this env; recommend CI.

Notes

• Node key is backend.apiKey; Python is backend.api_key (dataclass snake_case) — same value, per-language path; the redaction regex (api_?key) covers both.
• CLI_SPEC.md documents the resolution order, redaction, 0600, and the global-only trust boundary.

🤖 Generated with Claude Code